Everything about JavaScript

Pick a connection profile and a target load time, and arithmetic hands you a byte budget per resource class. A web performance budget is a decision tool: it tells you which image, which font and which plugin gets told no, before the page ever gets slow.

Every photograph carries a block of tags nobody looks at: camera, lens, exposure, three timestamps, and often the coordinates of the room it was taken in. Read yours in the browser, then learn what each field means, who wrote it, and what quietly removes it.

WordPress has added loading="lazy" itself since 5.5, and it skips the first three media elements on purpose, because the top one is usually the largest contentful paint element. Here is the real mechanism: the functions, the threshold of 3, fetchpriority, and the places where the logic never runs.

The eight define() lines in wp-config.php sign every admin cookie and every nonce your site issues. What each one does, why Math.random cannot be trusted to make them, what actually breaks when you rotate them, and an offline generator for the replacements.

An SVG is not an image file, it is an XML document, which is why the same file can carry a script element and several kilobytes of editor litter at once. What is actually inside one, what a sanitiser removes, why six decimal places describe nothing a screen can show, and why a missing viewBox is the reason a logo turns up at the wrong size.

A Content Security Policy is the header everyone knows they should have and nobody dares enforce. What it actually stops, why a policy with only default-src is either useless or breaks everything, the two keywords that undo the whole thing, and what fails first on a real WordPress site.